🔍 Add Authentication Debugging

- Added debug logging to getUserFromRequest function
- Log when no auth header is found vs when token verification fails
- Log token verification attempts and decoded results
- This will help identify why 'All My Cards' collection lookup is failing

The issue appears to be that the development fallback always returns admin user,
but users are trying to access collections belonging to other users (like Bob).
This debugging will help us see if tokens are being sent properly.

lib/permission-middleware.js

@@ -13,11 +13,14 @@ export async function getUserFromRequest(req) {
     if (!authHeader || !authHeader.startsWith('Bearer ')) {
       // For development, return user ID 1 if no token (should be removed in production)
       console.warn('⚠️  Development mode: Using fallback user authentication');
+      console.warn('⚠️  No auth header found:', authHeader);
       return { userId: 1, email: 'admin@tcgvault.com', role: 'admin' };
     }
 
     const token = authHeader.substring(7);
+    console.log('🔍 Attempting to verify token:', token.substring(0, 20) + '...');
     const decoded = jwt.verify(token, JWT_SECRET);
+    console.log('✅ Token decoded successfully:', decoded);
     
     // Get user data from database
     const result = await sql`